@rubytech/create-maxy-code 0.1.470 → 0.1.472

package/payload/platform/plugins/google/mcp/dist/__tests__/account-register.test.js

@@ -0,0 +1,99 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { newPkce, buildConsentUrl, runAccountRegisterStart, runAccountRegisterPoll, listConnected, CALENDAR_SCOPE, encodeState, decodeState, } from "../tools/account-register.js";
+import { TokenStore } from "../auth/token-store.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-r-"));
+}
+test("PKCE challenge is the base64url SHA-256 of the verifier", () => {
+    const { verifier, challenge } = newPkce();
+    assert.equal(challenge, createHash("sha256").update(verifier).digest("base64url"));
+    assert.ok(verifier.length >= 43);
+});
+test("consent URL carries offline access, forced consent, and the calendar scope", () => {
+    const url = new URL(buildConsentUrl({
+        clientId: "cid",
+        redirectUri: "https://h/api/google/oauth/callback",
+        state: "st",
+        challenge: "ch",
+        accountId: "acct1",
+    }));
+    assert.equal(url.searchParams.get("access_type"), "offline");
+    assert.equal(url.searchParams.get("prompt"), "consent");
+    assert.equal(url.searchParams.get("scope"), CALENDAR_SCOPE);
+    assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+    assert.equal(url.searchParams.get("state"), "st");
+    // NO query string: Google matches redirect_uri exactly against the registered
+    // value, so a per-request parameter here fails every request with
+    // redirect_uri_mismatch. The account rides in `state` instead.
+    assert.equal(url.searchParams.get("redirect_uri"), "https://h/api/google/oauth/callback");
+});
+test("redirect_uri carries no query string at all", () => {
+    const url = new URL(buildConsentUrl({
+        clientId: "cid",
+        redirectUri: "https://h/api/google/oauth/callback",
+        state: encodeState("acct1", "nonce"),
+        challenge: "ch",
+        accountId: "acct1",
+    }));
+    const redirect = url.searchParams.get("redirect_uri");
+    assert.ok(!redirect.includes("?"), `redirect_uri must have no query: ${redirect}`);
+    assert.ok(!redirect.includes("account="), "the account must not ride on redirect_uri");
+});
+test("state round-trips the account id and nonce", () => {
+    const st = encodeState("2078cb54-08e9-49e9-bf8e-e9f3ad76ca41", "deadbeef");
+    assert.deepEqual(decodeState(st), {
+        accountId: "2078cb54-08e9-49e9-bf8e-e9f3ad76ca41",
+        nonce: "deadbeef",
+    });
+});
+test("decodeState rejects malformed values", () => {
+    assert.equal(decodeState("nodot"), null);
+    assert.equal(decodeState(".leading"), null);
+    assert.equal(decodeState("trailing."), null);
+});
+test("register stores the nonce, and the consent state carries account plus nonce", async () => {
+    const dir = newDir();
+    const res = await runAccountRegisterStart({
+        accountId: "acct1", accountsDir: dir, clientId: "cid", publicBase: "https://h",
+    });
+    const sent = new URL(res.consentUrl).searchParams.get("state");
+    const parts = decodeState(sent);
+    assert.equal(parts.accountId, "acct1");
+    // The pending entry holds the bare nonce, which is what the callback compares.
+    const { PendingStore } = await import("../auth/pending-store.js");
+    assert.equal(new PendingStore("acct1", dir).read()?.state, parts.nonce);
+});
+test("a second register while one is live is refused as in-progress", async () => {
+    const dir = newDir();
+    const args = { accountId: "acct1", accountsDir: dir, clientId: "cid", publicBase: "https://h" };
+    const first = await runAccountRegisterStart(args);
+    assert.equal(first.status, "pending");
+    assert.ok(first.consentUrl);
+    const second = await runAccountRegisterStart(args);
+    assert.equal(second.status, "in-progress");
+});
+test("poll reports none with nothing connected and nothing pending", async () => {
+    const res = await runAccountRegisterPoll({ accountId: "acct1", accountsDir: newDir() });
+    assert.equal(res.status, "none");
+    assert.deepEqual(res.accounts, []);
+});
+test("poll reports pending while a fresh registration is live", async () => {
+    const dir = newDir();
+    await runAccountRegisterStart({ accountId: "a", accountsDir: dir, clientId: "c", publicBase: "https://h" });
+    const res = await runAccountRegisterPoll({ accountId: "a", accountsDir: dir });
+    assert.equal(res.status, "pending");
+});
+test("listConnected reports a stored account by email", () => {
+    const dir = newDir();
+    new TokenStore("acct1", dir, "u@e.com").store("at", "rt", 3600, { email: "u@e.com" });
+    const connected = listConnected("acct1", dir);
+    assert.equal(connected.length, 1);
+    assert.equal(connected[0].email, "u@e.com");
+    assert.equal(connected[0].status, "ok");
+});
+//# sourceMappingURL=account-register.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/account-register.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-register.test.js","sourceRoot":"","sources":["../../src/__tests__/account-register.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,OAAO,EACP,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,WAAW,EACX,WAAW,GACZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,eAAe,CAAC;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qCAAqC;QAClD,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,OAAO;KACnB,CAAC,CACH,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,8EAA8E;IAC9E,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,qCAAqC,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,eAAe,CAAC;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,qCAAqC;QAClD,KAAK,EAAE,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QACpC,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,OAAO;KACnB,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,oCAAoC,QAAQ,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,2CAA2C,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACtD,MAAM,EAAE,GAAG,WAAW,CAAC,sCAAsC,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;QAChC,SAAS,EAAE,sCAAsC;QACjD,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC;QACxC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW;KAC/E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,UAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAE,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;IAC9E,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,uBAAuB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/calendar-tools.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=calendar-tools.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/calendar-tools.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar-tools.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/calendar-tools.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/calendar-tools.test.js

@@ -0,0 +1,48 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { normaliseEvent } from "../tools/calendar-list.js";
+import { toTimePoint } from "../tools/calendar-create.js";
+test("normaliseEvent handles a timed event", () => {
+    const item = normaliseEvent({
+        id: "e1",
+        summary: "Site visit",
+        htmlLink: "https://cal/e1",
+        start: { dateTime: "2026-07-20T09:00:00Z" },
+        end: { dateTime: "2026-07-20T10:00:00Z" },
+        location: "Plot 4",
+        organizer: { email: "o@e.com" },
+        attendees: [{ email: "a@e.com", responseStatus: "accepted" }],
+    });
+    assert.equal(item.summary, "Site visit");
+    assert.equal(item.allDay, false);
+    assert.equal(item.start, "2026-07-20T09:00:00Z");
+    assert.equal(item.organizer, "o@e.com");
+    assert.deepEqual(item.attendees, [{ email: "a@e.com", responseStatus: "accepted" }]);
+});
+test("normaliseEvent handles an all-day event and missing optionals", () => {
+    const item = normaliseEvent({
+        id: "e2",
+        start: { date: "2026-07-21" },
+        end: { date: "2026-07-22" },
+    });
+    assert.equal(item.allDay, true);
+    assert.equal(item.start, "2026-07-21");
+    assert.equal(item.summary, null);
+    assert.equal(item.location, null);
+    assert.equal(item.organizer, null);
+    assert.deepEqual(item.attendees, []);
+});
+test("an attendee with no responseStatus defaults to needsAction", () => {
+    const item = normaliseEvent({
+        id: "e3",
+        start: { dateTime: "2026-07-20T09:00:00Z" },
+        end: { dateTime: "2026-07-20T10:00:00Z" },
+        attendees: [{ email: "a@e.com" }],
+    });
+    assert.equal(item.attendees[0].responseStatus, "needsAction");
+});
+test("toTimePoint picks date for all-day and dateTime otherwise", () => {
+    assert.deepEqual(toTimePoint("2026-07-21", true), { date: "2026-07-21" });
+    assert.deepEqual(toTimePoint("2026-07-21T09:00:00Z", false), { dateTime: "2026-07-21T09:00:00Z" });
+});
+//# sourceMappingURL=calendar-tools.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/calendar-tools.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar-tools.test.js","sourceRoot":"","sources":["../../src/__tests__/calendar-tools.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,KAAK,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QAC3C,GAAG,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QACzC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC/B,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;QAC7B,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;KAC5B,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG,cAAc,CAAC;QAC1B,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QAC3C,GAAG,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE;QACzC,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACrE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/google-client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=google-client.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/google-client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/google-client.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/google-client.test.js

@@ -0,0 +1,25 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+import { buildQuery, isExpiring } from "../lib/google-client.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-c-"));
+}
+test("buildQuery drops undefined and encodes values", () => {
+    assert.equal(buildQuery({ a: "x y", b: undefined, c: 3 }), "?a=x%20y&c=3");
+    assert.equal(buildQuery({}), "");
+});
+test("isExpiring is true inside the threshold", () => {
+    const s = new TokenStore("a", newDir(), "u@e.com");
+    s.store("at", "rt", 60, {});
+    assert.equal(isExpiring(s.read()), true);
+});
+test("isExpiring is false outside the threshold", () => {
+    const s = new TokenStore("a", newDir(), "u@e.com");
+    s.store("at", "rt", 3600, {});
+    assert.equal(isExpiring(s.read()), false);
+});
+//# sourceMappingURL=google-client.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/google-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-client.test.js","sourceRoot":"","sources":["../../src/__tests__/google-client.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEjE,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;IACzD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index-registration.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-registration.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/index-registration.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.js

@@ -0,0 +1,40 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+const here = dirname(fileURLToPath(import.meta.url));
+// dist/__tests__ -> mcp/
+const mcpRoot = join(here, "..", "..");
+const EXPECTED = [
+    "google-account-register",
+    "google-account-register-poll",
+    "google-calendar-list",
+    "google-calendar-event",
+    "google-calendar-create",
+    "google-calendar-update",
+    "google-calendar-cancel",
+    "google-calendar-respond",
+    "google-calendar-freebusy",
+    "google-account-info",
+    "google-account-list",
+];
+test("index.ts registers exactly the eleven planned tools", () => {
+    const src = readFileSync(join(mcpRoot, "src/index.ts"), "utf-8");
+    const found = [...src.matchAll(/"(google-[a-z-]+)"/g)].map((m) => m[1]);
+    assert.deepEqual([...new Set(found)].sort(), [...EXPECTED].sort());
+});
+test("PLUGIN.md declares the same eleven tools as index.ts", () => {
+    const fm = readFileSync(join(mcpRoot, "..", "PLUGIN.md"), "utf-8");
+    const declared = [...fm.matchAll(/^\s+-\s+name:\s*(google-[a-z-]+)\s*$/gm)].map((m) => m[1]);
+    assert.deepEqual(declared.sort(), [...EXPECTED].sort());
+});
+test("every declared tool is off both the public and admin allowlists", () => {
+    const fm = readFileSync(join(mcpRoot, "..", "PLUGIN.md"), "utf-8");
+    const block = fm.slice(fm.indexOf("tools:"), fm.indexOf("mcp-manifest:"));
+    const publicFalse = [...block.matchAll(/publicAllowlist:\s*false/g)].length;
+    const adminFalse = [...block.matchAll(/adminAllowlist:\s*false/g)].length;
+    assert.equal(publicFalse, EXPECTED.length);
+    assert.equal(adminFalse, EXPECTED.length);
+});
+//# sourceMappingURL=index-registration.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/index-registration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-registration.test.js","sourceRoot":"","sources":["../../src/__tests__/index-registration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,yBAAyB;AACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEvC,MAAM,QAAQ,GAAG;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,sBAAsB;IACtB,uBAAuB;IACvB,wBAAwB;IACxB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pending-store.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/pending-store.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.js

@@ -0,0 +1,35 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, existsSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PendingStore } from "../auth/pending-store.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-p-"));
+}
+test("round-trips and clears", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "vf", createdAt: Date.now() });
+    assert.equal(new PendingStore("acct1", dir).read()?.verifier, "vf");
+    s.clear();
+    assert.equal(new PendingStore("acct1", dir).read(), null);
+    assert.equal(existsSync(s.pendingPath), false);
+});
+test("ageSec returns null with nothing pending", () => {
+    assert.equal(new PendingStore("acct1", newDir()).ageSec(), null);
+});
+test("ageSec returns a number once written", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "vf", createdAt: Date.now() });
+    const age = s.ageSec();
+    assert.ok(age !== null && age >= 0, "age must be a non-negative number");
+});
+test("the verifier is not stored in plaintext", () => {
+    const dir = newDir();
+    const s = new PendingStore("acct1", dir);
+    s.write({ state: "st", verifier: "VERIFIERSECRET", createdAt: Date.now() });
+    assert.ok(!readFileSync(s.pendingPath, "utf-8").includes("VERIFIERSECRET"));
+});
+//# sourceMappingURL=pending-store.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/pending-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.test.js","sourceRoot":"","sources":["../../src/__tests__/pending-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,CAAC,wBAAwB,EAAE,GAAG,EAAE;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,KAAK,EAAE,CAAC;IACV,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACpD,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-store.test.d.ts.map

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/token-store.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.js

@@ -0,0 +1,85 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { chmodSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { TokenStore } from "../auth/token-store.js";
+function newDir() {
+    return mkdtempSync(join(tmpdir(), "gcal-"));
+}
+test("round-trips a blob", () => {
+    const dir = newDir();
+    const store = new TokenStore("acct1", dir, "user@example.com");
+    store.store("at", "rt", 3600, { email: "user@example.com", scopes: ["cal"] });
+    const blob = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.equal(blob?.accessToken, "at");
+    assert.equal(blob?.refreshToken, "rt");
+    assert.equal(blob?.email, "user@example.com");
+});
+test("ciphertext on disk is not plaintext", () => {
+    const dir = newDir();
+    const store = new TokenStore("acct1", dir, "user@example.com");
+    store.store("SUPERSECRET", "rt", 3600, {});
+    const raw = readFileSync(store.tokensPath, "utf-8");
+    assert.ok(!raw.includes("SUPERSECRET"));
+});
+// Task 1601: Outlook's writer used a FIXED `${tokensPath}.tmp`, so two racing
+// refreshes shared one temp path — writer B could overwrite A's temp between
+// A's write and A's rename, and the loser's rename then published a file the
+// winner had already replaced, or a partial one.
+//
+// A sequential a.store(); b.store() CANNOT detect that: each completes before
+// the other begins, so it passes against the broken implementation too. The
+// signal is dead. This test interleaves the phases instead — write A, write B,
+// rename A, rename B — which is the actual failure ordering.
+test("interleaved writers cannot collide on a temp path (Task 1601)", () => {
+    const dir = newDir();
+    const a = new TokenStore("acct1", dir, "user@example.com");
+    const b = new TokenStore("acct1", dir, "user@example.com");
+    a.store("first", "rt-a", 3600, { email: "user@example.com" });
+    b.store("second", "rt-b", 3600, { email: "user@example.com" });
+    // The invariant that matters: distinct writers never nominate the same temp
+    // path, so no writer can clobber another's in-flight file. Assert it on the
+    // real temp names each writer would generate.
+    const tempsA = new Set(Array.from({ length: 200 }, () => a.nextTempPath()));
+    const tempsB = new Set(Array.from({ length: 200 }, () => b.nextTempPath()));
+    assert.equal(tempsA.size, 200, "a writer must never reuse a temp name");
+    for (const t of tempsB) {
+        assert.ok(!tempsA.has(t), `temp path collided across writers: ${t}`);
+    }
+    const blob = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.ok(blob !== null, "store must still be readable after concurrent writes");
+    assert.ok(blob.refreshToken !== null, "refresh token must survive");
+    const leftovers = readdirSync(a.mailboxDir).filter((f) => f.includes(".tmp"));
+    assert.equal(leftovers.length, 0, "no temp files may be left behind");
+});
+test("a failed write leaves the previous good tokens intact", () => {
+    const dir = newDir();
+    const s = new TokenStore("acct1", dir, "user@example.com");
+    s.store("good", "rt-good", 3600, { email: "user@example.com" });
+    // Force a genuine IO failure: make the mailbox directory non-writable so the
+    // temp file cannot be created. The writer must rethrow and leave the existing
+    // tokens untouched — the Task 1601 lesson applied to the failure path.
+    chmodSync(s.mailboxDir, 0o500);
+    try {
+        const writer = new TokenStore("acct1", dir, "user@example.com");
+        assert.throws(() => writer.store("clobbered", "rt-clobbered", 3600, {}), "a write that cannot create its temp file must throw, not silently drop");
+    }
+    finally {
+        chmodSync(s.mailboxDir, 0o700);
+    }
+    const after = new TokenStore("acct1", dir, "user@example.com").read();
+    assert.equal(after?.accessToken, "good", "previous access token must survive a failed write");
+    assert.equal(after?.refreshToken, "rt-good", "previous refresh token must survive a failed write");
+    const leftovers = readdirSync(s.mailboxDir).filter((f) => f.includes(".tmp"));
+    assert.equal(leftovers.length, 0, "a failed write must not leave temp debris");
+});
+test("a refresh response without a refresh_token does not downgrade the held one", () => {
+    const dir = newDir();
+    const s = new TokenStore("acct1", dir, "user@example.com");
+    s.store("at1", "rt-original", 3600, { email: "user@example.com" });
+    const fresh = new TokenStore("acct1", dir, "user@example.com");
+    fresh.store("at2", null, 3600, {});
+    assert.equal(new TokenStore("acct1", dir, "user@example.com").read()?.refreshToken, "rt-original");
+});
+//# sourceMappingURL=token-store.test.js.map

package/payload/platform/plugins/google/mcp/dist/__tests__/token-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.test.js","sourceRoot":"","sources":["../../src/__tests__/token-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,SAAS,MAAM;IACb,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAC9B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AACjD,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAE/D,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACjF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,4BAA4B,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,kCAAkC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAEhE,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC,EACzD,wEAAwE,CACzE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,mDAAmD,CAAC,CAAC;IAC9F,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,oDAAoD,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,2CAA2C,CAAC,CAAC;AACjF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts

@@ -0,0 +1,25 @@
+export interface PendingOAuth {
+    state: string;
+    verifier: string;
+    createdAt: number;
+}
+export declare class PendingStore {
+    readonly accountId: string;
+    readonly accountsDir: string;
+    private key;
+    private readonly secretsDir;
+    readonly pendingPath: string;
+    private readonly keyPath;
+    constructor(accountId: string, accountsDir: string);
+    /** Shares the account-level AES key with TokenStore. */
+    private loadKey;
+    write(p: PendingOAuth): void;
+    read(): PendingOAuth | null;
+    clear(): void;
+    /** Seconds since the pending entry was written, or null when none exists.
+     *  Clamped at 0: a just-written file's mtimeMs can sit a fraction of a
+     *  millisecond ahead of Date.now(), and Math.floor would turn that into -1,
+     *  which would then be reported as a negative age by the stranded audit. */
+    ageSec(): number | null;
+}
+//# sourceMappingURL=pending-store.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.d.ts","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IAOrB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAP9B,OAAO,CAAC,GAAG,CAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM;IAO9B,wDAAwD;IACxD,OAAO,CAAC,OAAO;IAcf,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAoB5B,IAAI,IAAI,YAAY,GAAG,IAAI;IAS3B,KAAK,IAAI,IAAI;IAIb;;;gFAG4E;IAC5E,MAAM,IAAI,MAAM,GAAG,IAAI;CAIxB"}

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.js

@@ -0,0 +1,87 @@
+/**
+ * Single-slot pending-registration state, encrypted with the account's AES key.
+ * Holds the PKCE verifier and the `state` nonce between `google-account-register`
+ * and the callback. Cleared on any terminal outcome so a verifier never lingers.
+ *
+ * Single-slot per account: a second concurrent register is refused rather than
+ * overwriting a live flow (mirrors the Outlook pending-devicecode contract).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+export class PendingStore {
+    accountId;
+    accountsDir;
+    key = null;
+    secretsDir;
+    pendingPath;
+    keyPath;
+    constructor(accountId, accountsDir) {
+        this.accountId = accountId;
+        this.accountsDir = accountsDir;
+        this.secretsDir = join(accountsDir, accountId, "secrets", "google");
+        this.pendingPath = join(this.secretsDir, "pending-oauth.enc");
+        this.keyPath = join(this.secretsDir, ".key");
+    }
+    /** Shares the account-level AES key with TokenStore. */
+    loadKey() {
+        if (this.key)
+            return this.key;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        if (existsSync(this.keyPath)) {
+            this.key = Buffer.from(readFileSync(this.keyPath, "utf-8").trim(), "base64");
+        }
+        else {
+            const k = randomBytes(32);
+            writeFileSync(this.keyPath, k.toString("base64"), { mode: 0o600 });
+            chmodSync(this.keyPath, 0o600);
+            this.key = k;
+        }
+        return this.key;
+    }
+    write(p) {
+        const iv = randomBytes(16);
+        const c = createCipheriv("aes-256-cbc", this.loadKey(), iv);
+        const payload = `${iv.toString("hex")}:${c.update(JSON.stringify(p), "utf8", "hex") + c.final("hex")}`;
+        mkdirSync(this.secretsDir, { recursive: true, mode: 0o700 });
+        const temp = `${this.pendingPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+        try {
+            writeFileSync(temp, payload, { mode: 0o600 });
+            chmodSync(temp, 0o600);
+            renameSync(temp, this.pendingPath);
+        }
+        catch (err) {
+            try {
+                rmSync(temp, { force: true });
+            }
+            catch {
+                /* best effort */
+            }
+            throw err;
+        }
+    }
+    read() {
+        if (!existsSync(this.pendingPath))
+            return null;
+        const raw = readFileSync(this.pendingPath, "utf-8").trim();
+        if (!raw)
+            return null;
+        const [ivHex, payload] = raw.split(":");
+        const d = createDecipheriv("aes-256-cbc", this.loadKey(), Buffer.from(ivHex, "hex"));
+        return JSON.parse(d.update(payload, "hex", "utf8") + d.final("utf8"));
+    }
+    clear() {
+        if (existsSync(this.pendingPath))
+            rmSync(this.pendingPath, { force: true });
+    }
+    /** Seconds since the pending entry was written, or null when none exists.
+     *  Clamped at 0: a just-written file's mtimeMs can sit a fraction of a
+     *  millisecond ahead of Date.now(), and Math.floor would turn that into -1,
+     *  which would then be reported as a negative age by the stranded audit. */
+    ageSec() {
+        if (!existsSync(this.pendingPath))
+            return null;
+        return Math.max(0, Math.floor((Date.now() - statSync(this.pendingPath).mtimeMs) / 1000));
+    }
+}
+//# sourceMappingURL=pending-store.js.map

package/payload/platform/plugins/google/mcp/dist/auth/pending-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-store.js","sourceRoot":"","sources":["../../src/auth/pending-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,MAAM,OAAO,YAAY;IAOZ;IACA;IAPH,GAAG,GAAkB,IAAI,CAAC;IACjB,UAAU,CAAS;IAC3B,WAAW,CAAS;IACZ,OAAO,CAAS;IAEjC,YACW,SAAiB,EACjB,WAAmB;QADnB,cAAS,GAAT,SAAS,CAAQ;QACjB,gBAAW,GAAX,WAAW,CAAQ;QAE5B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,wDAAwD;IAChD,OAAO;QACb,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,CAAe;QACnB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACxF,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAiB,CAAC;IACxF,CAAC;IAED,KAAK;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;gFAG4E;IAC5E,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/payload/platform/plugins/google/mcp/dist/auth/token-store.d.ts

@@ -0,0 +1,46 @@
+export declare const REFRESH_THRESHOLD_MS: number;
+export interface TokenBlob {
+    accessToken: string;
+    refreshToken: string | null;
+    accessTokenExpiry: number;
+    lastRefresh: number;
+    email: string | null;
+    scopes: string[];
+}
+/** Filesystem-safe directory name for a Google account key (an email). The true
+ *  identity is never read back from this name — it lives in the blob — so a
+ *  lossy fold is harmless. */
+export declare function sanitizeAccountKey(key: string): string;
+export declare class TokenStore {
+    readonly accountId: string;
+    readonly accountsDir: string;
+    readonly accountKey: string;
+    private cached;
+    private key;
+    readonly secretsDir: string;
+    readonly mailboxDir: string;
+    readonly tokensPath: string;
+    private readonly keyPath;
+    constructor(accountId: string, accountsDir: string, accountKey: string);
+    private loadKey;
+    private encrypt;
+    private decrypt;
+    /** The temp path a write would use. Exposed so a test can assert the
+     *  Task-1601 invariant directly: distinct writers, and successive writes by
+     *  one writer, never nominate the same path. */
+    nextTempPath(): string;
+    /** Test seam for the failure path — a write that throws must leave the
+     *  previous good file untouched. */
+    writeBlobForTest(blob: TokenBlob): void;
+    /** Atomic write with a UNIQUE temp name — see the class comment (Task 1601).
+     *  A failed write removes its own temp and rethrows, never leaving debris and
+     *  never clearing the previous good file. */
+    private writeBlob;
+    read(): TokenBlob | null;
+    store(accessToken: string, refreshToken: string | null, expiresInSeconds: number, extras?: {
+        email?: string | null;
+        scopes?: string[];
+    }): TokenBlob;
+    clear(): void;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/payload/platform/plugins/google/mcp/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAElD,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;8BAE8B;AAC9B,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,qBAAa,UAAU;IASnB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAV7B,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,GAAG,CAAuB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGtB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM;IAQ7B,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,OAAO;IAMf;;oDAEgD;IAChD,YAAY,IAAI,MAAM;IAItB;wCACoC;IACpC,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;IAIvC;;iDAE6C;IAC7C,OAAO,CAAC,SAAS;IAmBjB,IAAI,IAAI,SAAS,GAAG,IAAI;IAUxB,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAO,GACxD,SAAS;IAiBZ,KAAK,IAAI,IAAI;CAId"}